Add agent fingerprinting, client certificate auth, and security audit documentation

This commit adds:
- Database migrations for app_delta fingerprints and client certificates
- Scripts for certificate generation and fingerprint backfilling
- Comprehensive security audit reports and findings tracking
- Implementation documentation for certificate authentication
- Test utilities for certificate renewal and fingerprinting
- GE-ENFORCE collector fix documentation

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

nginx.conf

@@ -0,0 +1,55 @@
+events {
+    worker_connections 2048;
+}
+
+http {
+    upstream flask_backend {
+        server api:5001;
+    }
+
+    server {
+        listen 443 ssl;
+        server_name _;
+
+        # Server certificate (HTTPS)
+        ssl_certificate /etc/nginx/certs/server.crt;
+        ssl_certificate_key /etc/nginx/certs/server.key;
+
+        # Client certificate validation (optional during rollout)
+        # optional_no_ca: accept cert but don't validate against CA
+        # Flask validates fingerprint against database
+        ssl_verify_client optional_no_ca;
+
+        # Increase timeouts for long-polling agents
+        proxy_connect_timeout 90s;
+        proxy_send_timeout 90s;
+        proxy_read_timeout 90s;
+
+        # All routes
+        location / {
+            proxy_pass http://flask_backend;
+            proxy_http_version 1.1;
+            proxy_set_header Connection "";
+
+            # Pass real client IP (not nginx IP)
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header Host $host;
+
+            # Pass client certificate fingerprint to Flask
+            # SECURITY NOTE: $ssl_client_fingerprint outputs SHA1 (40 hex chars),
+            # not SHA256. This is a known nginx limitation. SHA1 is acceptable for
+            # certificate fingerprinting (not signing) in air-gapped environments
+            # with short-lived certs and revocation support.
+            # Format: "AB:CD:EF:..." (colon-separated hex, normalized in Flask)
+            # Future SHA256: requires custom nginx module or migrate to IIS
+            proxy_set_header X-Client-Cert-Fingerprint $ssl_client_fingerprint;
+            proxy_set_header X-Client-Cert-S-DN $ssl_client_s_dn;
+        }
+
+        # Access log includes client cert status
+        access_log /dev/stdout combined;
+        error_log /dev/stderr warn;
+    }
+}